Chapter 4. New features

The bootc package, which enables building and managing bootable container images, has been rebased to upstream version 1.16.4. This version provides important fixes and enhancements, most notably the following:

Jira:RHEL-213824

The Keylime packages are rebased to upstream version 7.14.3, which includes the following enhancements and bug fixes:

Jira:RHEL-180618

The keylime-agent-rust package is rebased to upstream version 0.2.10. With this update, the agent hashes qualifying data for the Trusted Platform Module (TPM) during Initial Attestation Key (IAK) certification.

Jira:RHEL-180619

The fapolicyd packages are rebased to upstream version 2.0.1 and provide many important enhancements and bug fixes over the previously available 1.4.3 version. Most notably:

Jira:RHEL-212483

With this update, the fagenrules script uses the fapolicyd-cli --check-rules command to validate the compiled ruleset before a service reload. This prevents service failures caused by invalid configuration files.

As a result, if validation fails, fagenrules aborts the reload operation, outputs diagnostic details, and preserves the active policy.

Jira:RHEL-13011

fapolicyd provides a sample rule in the /usr/share/fapolicyd/sample-rules/41-nfsd.rules file. You can use this rule to allow nfsd to access shared library files hosted on NFS-exported directories.

Jira:RHEL-73816

The opencryptoki packages, which implement the PKCS #11 cryptographic token interface, are rebased to upstream version 3.27.0. This version provides bug fixes and enhancements over the previous version. Notable changes by token type and component include:

Jira:RHEL-136096^[1]

This update introduces the sequoia-sq package, which provides the sq command-line tool to read and inspect OpenPGP certificates. As a result, you can inspect default RHEL RPM signing keys directly from the terminal.

Jira:RHEL-188914^[1]

This update changes how OpenSSL validates certificates. The internal check of a service’s own certificate chain at startup is no longer performed, as it is the peer’s responsibility to verify the chain during the handshake. Ensure that peer systems, clients or servers, are correctly configured to perform standard certificate chain validation to maintain security.

Jira:RHEL-256875

Before this update, when a LUKS device was formatted by using the --hash sha512 option and subsequently bound by using the clevis luks bind command, the cryptsetup luksDump command incorrectly reported SHA-256 instead of the configured SHA-512 hash algorithm. With this update, the cryptsetup luksDump command correctly reports the hash algorithm used during a LUKS device formatting.

Jira:RHEL-163324

With this update, the SELinux policy supports BIND packages with suffixes, ensuring daemons from all installed BIND packages start in the correct SELinux context.

As a result, you can install multiple BIND packages required for a smooth upgrade of the freeipa-server-dns package.

Jira:RHEL-192093

With this update, the hid_sensor_device_t, a custom SELinux context, is available for HID-SENSOR devices. It differentiates HID-SENSOR devices from USB devices to ensure correct labeling, improved access control, and STIG compliance.

Jira:RHEL-166739^[1]

The rsyslog package supports native Zabbix Low-Level Discovery (LLD) format for the impstats module and provides more granular metrics for the imkafka module. These enhancements eliminate the need for additional processing when you integrate rsyslog statistics with Zabbix monitoring systems. As a result, Zabbix can consume rsyslog statistics directly, and imkafka metrics provide finer operational detail.

Jira:RHEL-140914^[1]

The GnuTLS Transport Layer Security (TLS) stream driver in rsyslog checks whether configured Certificate Revocation List (CRL) files have expired. When a CRL file is past its validity period, the driver refuses to accept new TLS connections. This enhancement aligns the GnuTLS driver behavior with the OpenSSL driver, which already enforced CRL expiration. As a result, administrators using the GnuTLS driver with the defaultNetstreamDriverCRLFile parameter can ensure that expired CRLs prevent TLS connections.

Jira:RHEL-169794^[1]

With this update, the omelasticsearch module provides the tls.tlsversion, tls.ciphersuites, and tls.keyexchangegroups configuration parameters. You can use these parameters to configure TLS protocol versions, cipher suites, and key exchange groups when forwarding logs to Elasticsearch over TLS. This update also includes support for post-quantum cryptography (PQC) compatible key exchange algorithms.

Jira:RHEL-193506^[1]

The aide package includes the aide-check.timer systemd timer unit for automated integrity checks. With this timer, administrators can schedule periodic Advanced Intrusion Detection Environment (AIDE) integrity checks with CPU quota limits, without requiring custom cron jobs. As a result, administrators can configure AIDE automation by using standard systemd timer controls.

Jira:RHEL-178121^[1]

The aide package supports drop-in configuration files placed in the /etc/aide.d directory. The default /etc/aide.conf configuration file automatically includes *.conf files from /etc/aide.d. This enhancement enables administrators to add custom Advanced Intrusion Detection Environment (AIDE) rules without modifying the main configuration file. As a result, you/administrators can manage AIDE customizations separately from the base configuration.

Jira:RHEL-178122^[1]

The OpenSCAP packages have been rebased to upstream version 1.3.16. This version provides bug fixes and various enhancements. For additional information, see the OpenSCAP release notes.

Jira:RHEL-278223^[1]

For additional information, see the SCAP Security Guide release notes.

Jira:RHEL-242528

Before this update, synchronizing large repositories could be expensive because they could contain multiple versions of the same package built over time. With this release, the reposync utility supports a new --min-buildtime <YYYY-MM-DD> option. As a result, you can synchronize only a subset of the packages that were built since the specified timestamp.

Jira:RHEL-119475^[1]

The DNF utility copies POSIX access control lists (ACLs) from the existing /var/log/dnf.log file to a new, empty log file during rotation. As a result, custom permissions granted to specific users survive the log rotation process.

Jira:RHEL-122013

Before this update, the reconstruct command could not repair UIDVALIDITY mismatches between the mailbox index (cyrus.index) and the mailboxes database (mailboxes.db), causing mail transfer failures. With this update, the reconstruct command includes a new --fix-uidvalidity option that detects and corrects such mismatches.

By default, reconstruct updates the index to match the database; when combined with -M, the command updates the database to match the index instead. This option is specific to the Red Hat build of Cyrus IMAP.

Jira:RHEL-76907^[1]

RHEL 9.9 includes PHP 8.4. This version provides notable enhancements and bug fixes over version 8.3, most notably the following:

Jira:RHEL-105517

SystemTap has been rebased to version 5.5 and includes the following changes:

Jira:RHEL-169427^[1]

The elfutils tools and libraries include the following changes:

Jira:RHEL-169428^[1]

The valgrind package has been rebased from version to 3.27.1. The enhancements improve platform support on IBM Z systems, extend application introspection capabilities through new client requests, add support for recent Linux memory-management features to provide additional debugging and analysis options in Helgrind.

This update includes the following notable changes:

Jira:RHEL-169431^[1]

The bind package is rebased to upstream version 9.16.50. This update provides bug fixes and enhancements, including the following key changes:

Jira:RHEL-6454

With this update of the iproute package, the ip link command supports displaying the High-availability Seamless Redundancy (HSR) protocol version configured on an interface. This improvement simplifies the verification of the HSR version in fault-tolerant Ethernet network environments.

Jira:RHEL-134979^[1]

With this enhancement, RHEL supports the TCP Authentication Option (TCP-AO) as specified in RFC 5925. This feature provides a secure alternative to the TCP-MD5 (RFC 2385) extension, which is vulnerable to cryptographic collision attacks due to known weaknesses in the MD5 algorithm.

System administrators and application developers can now deprecate TCP-MD5 and transition to the more secure TCP-AO authentication method. You can configure TCP-AO by using standard socket APIs, specifically the setsockopt() system call, to bind TCP-AO keychains to active or listening sockets.

For more information, see the /usr/share/doc/kernel-doc-<version>/Documentation/networking/tcp_ao.rst file provided by the kernel-doc package.

Jira:RHEL-142637^[1]

The sendmail-milter package has moved from the CodeReady Linux Builder (CRB) repository to the RHEL 9 AppStream repository. As a result, you can install the sendmail-milter package without enabling the CRB repository.

Jira:RHEL-147755

With this enhancement, you can use the nmcli device set <interface> managed --permanent <option> command to permanently configure whether NetworkManager manages an interface. You can use the following options:

Jira:RHEL-157392^[1]

With this enhancement, you can use Nmstate to configure the following tunnel interfaces:

Jira:RHEL-166367

The zl3073x Digital Phase Locked Loop (DPLL) driver now supports reference-synchronization (ref-sync) pairing. With this feature, you can pair a high-frequency clock source with a separate, low-frequency synchronization signal, such as 1PPS or 8 kHz, by using hardware device tree settings.

As a result, you can achieve highly accurate phase alignment in timing-sensitive environments where clock and sync sources are provided separately. The driver automatically handles frequency validation and manages reference priorities if a source disconnects, simplifying configuration and preventing errors.

Jira:RHEL-167274^[1]

The zl3073x Digital Phase Locked Loop (DPLL) driver has been upgraded to upstream version 7.1. The most notable changes are:

Jira:RHEL-172939^[1]

Before this update, under sustained memory pressure, applications could remain on the memory direct reclaim path, reclaiming only small amounts of memory while severely degrading system performance and delaying or preventing the kernel from invoking the out-of-memory (OOM) killer. With this enhancement, the kernel provides two new sysctl parameters that adjust memory reclaim aggressiveness, giving you control over when the OOM killer is invoked under sustained memory pressure.

The available sysctl parameters are:

Jira:RHEL-100912^[1]

Before this update, the Runtime Verification (RV) monitors were compile-disabled for the CentOS Stream kernel. With this update, the kernel enables RV monitors, including the sched and rtapp monitors, to improve kernel functionality and reduce latency for real-time applications.

Jira:RHEL-116707^[1]

With this update, the Real-Time Linux Analysis (RTLA) framework supports the execution of custom extended Berkeley Packet Filter (eBPF) programs, enabling low-latency responses to threshold overflows. You can also use a custom eBPF program to process timer latency in real time.

Jira:RHEL-153391^[1]

Before this update, the Integrity Measurement Architecture (IMA) policy did not appraise executables on certain file systems, such as /proc, /sysfs, and /tmp. This gap allowed the root user to execute modified executables on those file systems without IMA verification.

With this update, the IMA policy appraises all execution attempts on these file systems, which reduces the attack surface. The only exception is temporary executable memory mapping, which the policy still allows to support libraries, such as libffi that require it.

As a result, IMA integrity enforcement is now more comprehensive, and modified executables on previously unevaluated file systems are no longer permitted to run without proper appraisal.

Jira:RHEL-153545^[1]

Before this update, the rtla timerlat auto-analysis (AA) tool omitted stack trace entries for kernel functions that could not be converted into symbols as well as any succeeding stack entries. With this release, a command-line option is available to control how the tool handles addresses for unknown functions, allowing the user to skip unknown addresses rather than stopping on them, or, alternatively, display all unknown addresses. As a result, you can identify latency spikes during automated tests more effectively.

Jira:RHEL-155232^[1]

With this enhancement, the kernel package provides a new redhat_only_zero_pages sysfs parameter for Kernel Samepage Merging (KSM). When you enable this parameter, KSM merges only pages whose content matches the zero page and skips all other pages during scanning. As a result, you can use KSM to combine zero-filled memory pages across the system without the overhead of deduplicating pages that have other content.

This option is useful in the following scenarios:

RHEL introduces the libzpc-provider and libzpc-tools packages to support security features on new IBM Z systems. Version 2 of libzpc uses OpenSSL to provide these capabilities.

Jira:RHEL-186086^[1]

This update adds support for Memory System Resource Partitioning and Monitoring (MPAM) on 64-bit ARM systems (also known as AArch64). With this feature, you can use the resctrl file system to monitor and allocate L3 cache and memory bandwidth on MPAM-compatible hardware, such as NVIDIA Grace-based systems. As a result, you can optimize workload performance, including the performance of virtual machines with assigned GPUs on 64-bit ARM hosts that use Grace-Hopper or Grace-Blackwell hardware.

Jira:RHEL-164227^[1]

With this release, the grub2 bootloader adds support for NVMe over Fibre Channel (NVMeoFC) on the ppc64le architecture. Previously, grub2 could not discover or boot from NVMe namespaces presented over a Fibre Channel fabric, which limited the storage configurations available for the boot device on IBM Power Systems.

As a result, you can now install and boot Red Hat Enterprise Linux from NVMeoFC-attached storage on IBM Power Systems. This support also includes booting from multiple NVMe boot paths, enabling multipath boot configurations for NVMeoFC devices.

Jira:RHEL-15853^[1]

With this update, the libaio library is rebased to version 0.3.112 or later. This update reintroduces the asynchronous polling feature to improve I/O performance in database-centric workloads. This change restores feature and performance parity between RHEL 8 and RHEL 9.

Jira:RHEL-192174^[1]

Before this update, renaming a cluster node required numerous manual configuration edits across multiple files.
This update adds the pcs cluster node rename-corosync and pcs cluster node rename-cib commands to automate and streamline the renaming process.

As a result, you can rename cluster nodes with significantly fewer manual interventions, which reduces the risk of misconfiguration.

Jira:RHEL-149172

Before this update, commands such as pcs resource update …​ op and pcs resource op add did not validate operation names or option values against the resource agent. As a consequence, pcs silently accepted unsupported operations or invalid values, which could lead to cluster misconfigurations.

This update introduces strict validation checks to resource and stonith configuration update commands. If you specify an operation name that the agent does not support, pcs returns an error, though you can override this check using the --force option. Invalid option values (such as role or on-fail) now trigger non-overridable errors, matching the existing behavior of pcs resource create. If pcs cannot load the agent metadata, it displays a warning but allows the command to proceed to avoid breaking existing automation workflows.

Additionally, the name=<value> syntax in pcs resource op add and pcs resource update …​ op is deprecated. You must pass the operation name as the first argument.

Jira:RHEL-176268^[1]

The sybaseASE resource agent requires you to explicitly configure the sybase_ase parameter instead of auto-detecting it from the SYBASE.env file. This change was implemented to prevent probe operation failures when sybase_home is a cluster-managed filesystem that is not yet mounted. As a result, monitor and stop operations return correct status codes even when the sybase_home filesystem is unavailable during resource probing.

Jira:RHEL-182808^[1]

The nfsserver resource agent actively monitors the rpc.mountd and nfsdcld processes in addition to the nfs-server.service unit. This enhancement was implemented to prevent silent service degradation when these critical NFSv4 components terminate unexpectedly while the parent nfs-server.service remains active. As a result, the Pacemaker cluster detects component failures and initiates recovery actions, eliminating the need for manual systemd drop-in configurations to bind service lifecycles.

Jira:RHEL-184272^[1]

The fence_vmware_rest fence agent supports token-based authentication as an alternative to password-based authentication. This feature was implemented to improve security by eliminating the need to store passwords in fence device configuration. As a result, you can configure passwordless authentication by using the --token-script parameter to specify a script that retrieves authentication tokens from the VMware vCenter API.

Jira:RHEL-193739^[1]

With this release, the GNU Debugger (gdb) is rebased to upstream version 17.2. This update provides multiple bug fixes and enhancements over the previously available version.

Notable enhancements include the following:

Jira:RHEL-126211^[1]

llvm-toolset is rebased to upstream LLVM 22.1.8 in Red Hat Enterprise Linux 9.9. This update provides new features, bug fixes, and performance improvements over the previously shipped version.

Notable changes include the following:

Jira:RHEL-140408

The rust package is updated to version 1.97. This update applies changes from upstream Rust versions 1.93 through 1.97, providing multiple bug fixes, enhancements, and security fixes over the previous version.

With this update, Rust switches to the v0 symbol mangling format. This change is not visible to most users. However, if you are debugging, using a sampling profiler such as perf, or using any other tool that inspects binaries, the raw symbol names differ and might not print in the demangled form. The v0 format provides more accurate demangling of symbols, notably for generic types. The gcc-toolset-12 package and later versions support this format, but perf on RHEL 9 does not.

Other notable changes are:

Jira:RHEL-141251

With this enhancement, the gcc-toolset-16-binutils package is available as part of GCC Toolset 16. This package provides version 2.46 of the GNU binary utilities, including the ld linker, the as assembler, and utilities such as objdump, readelf, nm, and strip for creating, inspecting, and modifying object files, archives, and other binaries.

This version of the binary utilities provides the following notable enhancements:

Jira:RHEL-169585

The glibc package provides 512-bit EVEX instruction variants of several string and memory functions by default on supported AMD Zen 5 processors. This change takes full advantage of the native 512-bit execution units on newer AMD hardware to increase execution throughput and can reduce execution time by up to 64 percent. The affected functions include strchr, strlen, strnlen, strrchr, strchrnul, and memchr.

In addition, a new runtime tunable, glibc.cpu.x86_cpu_features.preferred, is available. You can use this tunable to manually control the hardware feature preference.

Jira:RHEL-175520^[1]

Previously, when an LDAP user belonged to a large number of groups, for example 5,000 or more, user lookup operations such as id <username> took several minutes or timed out completely. This issue occurred because SSSD handled local database operations and group membership caching inefficiently during lookups.

With this update, SSSD includes multiple performance optimizations for user lookups and group membership handling. While these improvements apply to all configurations, they are most noticeable in RFC 2307 environments without nested groups. As a result, user lookups for users with thousands of group memberships complete faster and no longer time out.

Jira:RHEL-150439

With this enhancement, SSSD introduces the pam_gssapi_indicators_apply configuration option. SSSD uses this option to map Security Identifiers (SIDs) from a Kerberos ticket Privilege Attribute Certificate (PAC) to authentication indicators during pam_sss_gss requests. This provides support for Active Directory Authentication Mechanism Assurance, which uses SIDs to track authentication methods such as smart card logins.

Administrators can define mapping rules in sssd.conf using SID:<SID>:<authentication_indicator> triples. As a result, applications relying on pam_sss_gss.so can enforce access restrictions based on Active Directory authentication methods in the same way as IdM.

Jira:RHEL-152067^[1]

The python-qrcode packages have been rebased to upstream version 8.0. This version provides important fixes and enhancements, most notably the following:

Jira:RHEL-155709

Identity Management (IdM) administrators can configure the GNOME Display Manager (GDM) login screen to display multiple authentication mechanisms. In addition to existing smart card authentication, administrators can enable new passwordless methods, such as external identity providers (EIdP) and FIDO2-compatible passkeys. Enable the with-switchable-auth feature in authselect and configure the System Security Services Daemon (SSSD) to allow users to choose their preferred credential directly at login.

Passwordless authentication aligns with zero trust architecture by replacing static passwords with cryptographic proof that verifies both user identity and device integrity for each access request. For detailed configuration instructions, see Enabling authentication mechanism selection in GDM by using SSSD.

Jira:RHEL-156519^[1]

The openldap packages, which provide Lightweight Directory Access Protocol (LDAP) client utilities and libraries, have been rebased to upstream version 2.6.13. This rebase includes the following fixes from the intervening upstream releases:

Jira:RHEL-157475^[1]

The python-jwcrypto packages have been rebased to upstream version 1.5.7. This version provides important fixes and enhancements, most notably the following:

Jira:RHEL-168728

The 389-ds-base packages, which provide the 389 Directory Server, have been rebased to upstream version 2.9.0. This version provides the following fixes and enhancements:

Jira:RHEL-169530

Directory Server uses pthread_setname_np to assign OS-level names to all ns-slapd threads. The server designates worker threads as worker-0 through worker-N and applies descriptive names like listener, repl-prot, and repl-inc-res to other threads. All names stay within the 15-character Linux limit. This enhancement enables support engineers and administrators to identify thread purpose directly in tools such as pstack, top -H, and perf output without correlating thread IDs against internal data structures.

Jira:RHEL-174525^[1]

The python-ldap packages, which provide a Python application programming interface (API) for Lightweight Directory Access Protocol (LDAP) servers, have been rebased to upstream version 3.4.7. This rebase includes the following fixes from the intervening upstream releases:

Jira:RHEL-183876^[1]

The python-pyasn1 packages, which provide tools for encoding and decoding Abstract Syntax Notation One (ASN.1) data in Python, have been rebased to upstream version 0.6.4. This version provides the following security fixes:

Jira:RHEL-211095^[1]

The Lightning Memory-Mapped Database (LMDB) backend in 389-ds-base, available as a Technology Preview before this update, is fully supported starting with RHEL 9.9. As a result, you can use the LMDB backend for Directory Server databases in production environments with full support.

Jira:RHEL-228260

The ipa packages, which provide centralized Identity Management (IdM) services for managing users, hosts, authentication, and access policies, have been rebased to upstream version 4.13.4. This version provides important fixes and enhancements, most notably the following:

Jira:RHEL-238684^[1]

The ipauser and ipagroup modules in the ansible-freeipa package support a new query state that retrieves information about Identity Management (IdM) users and groups without modifying them. You can control which fields the query returns by using the query_param option, which accepts BASE for the essential fields, ALL for the complete field set, PKEY_ONLY for primary keys only, or a custom list of specific field names. As a result, you can register the output and consume it later in the same playbook to drive conditional tasks, build reports, or audit existing entries.

Jira:RHELDOCS-22299

The authselect utility disables group merging by default. Most deployments do not require group merging, and disabling it prevents group lookups from contacting every identity provider to improve system performance.

If your environment requires the system to combine group records from multiple Name Service Switch (NSS) sources, you must enable the feature by running the authselect enable-feature with-group-merging command.

Previously, authselect enabled group merging by default. This forced all group lookups to contact local files, SSSD, and systemd, which caused severe performance degradation under certain conditions.

Jira:RHEL-94650^[1]

The cockpit packages are rebased to upstream version 366, which provides important bug fixes and enhancements over the previous version. Notable changes include:

Jira:RHEL-157464

With the release of the RHSA-2026:98463 advisory, you can configure MaxConcurrentConnections in the [WebService] section of the /etc/cockpit/cockpit.conf file to restrict concurrent HTTP connections on the web console port. Connection attempts that exceed the specified limit are rejected immediately before the server processes inbound traffic. This helps protect the system against denial-of-service (DoS) and socket exhaustion.

The default limit is 500. Unlike the MaxStartups option, which limits concurrent unauthenticated login attempts, MaxConcurrentConnections drops excess connections at the HTTP layer.

Jira:RHELDOCS-22919^[1]

The timesync_ntp_servers list includes a new key parameter that specifies an authentication key for a Network Time Protocol (NTP) server. The key value includes the key ID, an optional type, and the key string, as described in the chrony.conf file documentation. To secure the key, encrypt it by using Ansible Vault. As a result, you can ensure that time synchronization between managed hosts and NTP servers is authenticated.

Jira:RHEL-145210^[1]

With this update, the podman RHEL system role provides two new parameters, restarts and restarts_on, that enable Quadlet services to automatically restart when their file or secret dependencies change. You can use these parameters to manage service restarts:

Jira:RHEL-145225^[1]

With this update, the sshd RHEL system role supports the GSSAPIAllowS4U2Self and GSSAPIProxyS4U2Services configuration options. As a result, you can set the RHEL system role variables to manage Kerberos S4U credential delegation settings in the sshd_config file across managed hosts.

Jira:RHEL-167858^[1]

This update introduces a new auditd RHEL system role, which uses Ansible to automate management of the Linux Audit daemon. You can configure daemon settings in /etc/audit/auditd.conf, and deploy persistent audit rules to /etc/audit/rules.d/.

With this system role, you can standardize audit logging across your infrastructure without writing custom playbooks or service workaround scripts. As a result, service reloads and policy updates run safely across managed systems without interrupting management workflows or violating daemon lifecycle constraints.

Jira:RHEL-170879

RHEL 9.9 introduces the trustee_server and trustee_client RHEL system roles to automate the deployment of Trustee server components and the configuration of Trustee clients for confidential computing.

The trustee_server role uses Podman Quadlets to deploy the following server components:

The trustee_client role configures confidential virtual machines (CVMs) to authenticate against the Trustee server. The role configures the following client components:

Jira:RHEL-175618^[1]

With this enhancement, the firewall RHEL system role uses an in-memory backend to apply user-defined changes and compare the resulting configuration to the current configuration. Previously, the role recreated configuration files and reloaded the firewalld service during every execution to determine if the state had changed. This caused unnecessary service reloads in environments where the configuration had not actually been modified. With this update, the role calculates the configuration difference in memory. As a result, this enables correct operation in Ansible check and diff modes to ensure that the firewalld service is only reloaded when actual changes are detected.

Jira:RHEL-176144^[1]

With this enhancement, the crypto-policies RHEL system role uses the update-crypto-policies --check command to verify whether the policy configuration has changed and automatically regenerates the policy if necessary. Additionally, if you modify the policy configuration outside of the system role, you can set the crypto_policies_force_regenerate variable to true to force regeneration.

As a result, you can modify policy files manually on your managed hosts and keep cryptographic policies fully synchronized.

Jira:RHEL-181360^[1]

With this enhancement, you can use the new certificate_trust variable of the certificate RHEL system role to add certificates or to remove them from the system certificate trust store. As a result, you can automate which Certificate Authority (CA) certificates are trusted by RHEL applications that use the system-wide store.

Jira:RHEL-210678^[1]

With this update, the fapolicyd system role introduces the fapolicyd_add_trusted_paths variable, which supports both individual files and non-empty directories. This variable replaces and deprecates fapolicyd_add_trusted_file to eliminate naming ambiguity around supported path types.

Jira:RHEL-219366^[1]

With this update, virtual machines (VMs) that run a RHEL 9 guest operating system and are configured with Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) can also use the Secure Timestamp Counter (SecureTSC) feature. SecureTSC prevents the hypervisor from altering the guest’s TSC after booting, which secures guest operations that use the Read Time-Stamp Counter (RDTSC) and Read Time-Stamp Counter and Processor ID (RDTSCP) instructions.

Jira:RHEL-10048^[1]

The sos utility uses the Red Hat Customer Portal GraphQL API to upload diagnostic archives and attachments to support cases.

With this enhancement, the sos upload and sos report --upload commands interact directly with the updated Customer Portal backend, ensuring reliable and secure data transfer during support case engagement.

Jira:RHEL-282625^[1]

With this update, you can generate uncompressed sos reports by using the --compression-type=none option. This option uploads core dumps faster and quickly restores hosts to service.

Jira:RHEL-299693

With this update, the sos clean utility is optimized for improved performance.

As a result, the improved SOS cleaner ensures faster execution without any regression in sanitization and enhances overall efficiency for end users.

Jira:RHEL-299699

Before this update, the Podman API service running over a TCP socket did not support native TLS encryption or client certificate authentication. As a consequence, securing TCP sockets to satisfy security compliance standards, such as CIS benchmarks, required configuring and maintaining external proxy software, such as HAProxy.

With this update, you can configure TLS and mTLS encryption and authentication directly through the podman system service command without external proxy software. This simplifies system architecture and enables secure remote API communication to security compliance standards.

Jira:RHEL-91221

Before this update, you could configure a startup health check command during container creation only by using the Podman command-line interface (CLI).

With this update, the podman-py library supports setting startup health check parameters when you create a container by using the containers.create() method. As a result, you can define startup health checks in Python automation without relying on the CLI.

For more information, see Container create options

Jira:RHEL-140716^[1]

The updated Container Tools RPM meta-package, which includes the Podman, Buildah, and Skopeo is available. The buildah package has been updated to version 1.43.2, Skopeo has been updated to version 1.22.2, and Podman has been updated to version 5.8.5. The notable bug fixes and enhancements over the previous version are:

Jira:RHEL-244697

The ubi9/dotnet-110, ubi9/dotnet-110-aspnet and ubi9/dotnet-110-runtime are now available in the Red Hat Container Registry. The notable enhancements for each image are:

Jira:RHELDOCS-22303^[1]

With this update, the bootc-image-builder utility uses image-builder-cli as its backend. This update aligns the tool with upstream releases to deliver faster feature updates and security fixes while maintaining backward compatibility with your existing commands and workflows.

Jira:RHELDOCS-22243^[1]